[Libusb-win32-devel] struct usb_device* lifetimes

[Dan E. <Dan...@ne...>]

I've just spotted a problem which probably explains quite a bit of
strange behaviour which has been seen:

When a device is unplugged, a subsequent call to usb_find_devices will
free the struct usb_device, even though some other part of the software
may have a handle open on the device, with the handle structure holding
a pointer of the (now invalid) device.

Subsequent calls through the API using the handle will now use the freed
memory which may now contain something completely different, and cause
very strange behaviour, rather than just producing the correct error
that there is no device present.

I think the struct usb_device objects need to contain a reference count
of how many times they've been opened, and they should only be
immediately deleted in usb_find_devices if the reference count is zero,
otherwise the object needs flagging as deleted. Furthermore, when a
handle is closed, it should check if the device object has been marked
as deleted and deleted it at that point, and any attempts to use a
handle containing a deleted object should fail (i.e. there needs to be a
check any time a handle is used that the object is not marked deleted).

Not deleting the struct usb_device is a rather horrible workaround, at
least then the memory won't have been corrupted and behaviour should be
less unexpected.

I'm not sure how badly this bug affects the linux version of the
library, but they seem closer to releasing the new API which doesn't
seem to suffer from this problem.

Dan.